Interactive Code Annotation for Security Vulnerability Detection
Heather Richter Lipford, Tyler W. Thomas, Bill Chu, Emerson R. Murphy-Hill · 2014
Security vulnerabilities are commonly caused by security bugs introduced by developers during code construction. Static analysis tools can detect such vulnerabilities, yet are often not utilized by developers, leaving them out of the security loop. We are investigating interactive static analysis, to assist developers in detecting and mitigating security vulnerabilities during code construction. We propose interactive code annotation as a technique to gather security-related decisions from developers to aid in vulnerability detection. In this paper, we discuss the lessons we have learned in a technical and user evaluation of our current prototype, and the resulting design of our code annotation interface. The design decisions we present can help to inform the design of other annotation and security tools.